emotet | 468f63a20521f7316265e2885390416bd3d58826cafd082d963dfd02b82e92e2 | Triage™

Analysis

max time kernel
119s
max time network
135s
platform
windows10_x64
resource
win10-en-20211208
submitted
28/01/2022, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
71w8eb.dll
Size 544KB
Sample220128-ws7t6aadc3
SHA256 468f63a20521f7316265e2885390416bd3d58826cafd082d963dfd02b82e92e2
MD5 5f35162789c7c9a0085f0ccdb1ce5011
SHA1 1613c4c35171605deadbfc7cc13a673addb5036b
SHA512 bc2baa9e2e486eb43773900cbc2d7e0823e970fa2a0ac7ed4f89f5c1b525e6b76159a5a3f081aea70077ab8028e6ef290afbb43f2d6c51f7c3acf4531142d132
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2772	2460	regsvr32.exe	68
PID 2460 wrote to memory of 2772	2460	regsvr32.exe	68
PID 2460 wrote to memory of 2772	2460	regsvr32.exe	68
PID 2772 wrote to memory of 1580	2772	regsvr32.exe	69
PID 2772 wrote to memory of 1580	2772	regsvr32.exe	69
PID 2772 wrote to memory of 1580	2772	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\71w8eb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\71w8eb.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\71w8eb.dll",DllRegisterServer
    3⤵
    PID:1580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2772-119-0x0000000004B20000-0x0000000004B47000-memory.dmp

Download